{"id":"CVE-2026-88858","title":"Server-side expression parser denial of service","summary":"A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-674","CWE-20","CWE-400"],"vendor":"Grafana","product":"Grafana OSS","affected":["oss >= 7.4.0 <= 11.6.16","oss >= 12.0.0 <= 12.2.10","oss >= 12.3.0 <= 12.3.11","oss >= 12.4.0 <= 12.4.13","oss >= 13.0.0 <= 13.0.11","oss >= 13.1.0 <= 13.1.8","oss >= 13.2.0 <= 13.2.4","enterprise >= 7.4.0 <= 11.6.16","enterprise >= 12.0.0 <= 12.2.10","enterprise >= 12.3.0 <= 12.3.11","enterprise >= 12.4.0 <= 12.4.13","enterprise >= 13.0.0 <= 13.0.11","enterprise >= 13.1.0 <= 13.1.8","enterprise >= 13.2.0 <= 13.2.4"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:50:17.291Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88858","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-88858"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T17:14:44.435Z","slug":"CVE-2026-88858","body":"## Overview\n\nA user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.\n\n## Affected\n\n- `oss >= 7.4.0 <= 11.6.16`\n- `oss >= 12.0.0 <= 12.2.10`\n- `oss >= 12.3.0 <= 12.3.11`\n- `oss >= 12.4.0 <= 12.4.13`\n- `oss >= 13.0.0 <= 13.0.11`\n- `oss >= 13.1.0 <= 13.1.8`\n- `oss >= 13.2.0 <= 13.2.4`\n- `enterprise >= 7.4.0 <= 11.6.16`\n- `enterprise >= 12.0.0 <= 12.2.10`\n- `enterprise >= 12.3.0 <= 12.3.11`\n- `enterprise >= 12.4.0 <= 12.4.13`\n- `enterprise >= 13.0.0 <= 13.0.11`\n- `enterprise >= 13.1.0 <= 13.1.8`\n- `enterprise >= 13.2.0 <= 13.2.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}